@blamejs/pki 0.8.30 → 0.8.48

package/lib/guard-crypto.js

@@ -4,12 +4,210 @@
 // @internal
 
 var nodeCrypto = require("node:crypto");
-var _freeze = require("./guard-intrinsic").freeze;
+var intrinsic = require("./guard-intrinsic");
+var _freeze = intrinsic.freeze;
+
+/** @internal The hash operations, captured at load. The prototype is read from an instance rather than
+ *  named, `node:crypto` exporting no Hash constructor. */
+var _createHash = nodeCrypto.createHash;
+var _hashProto = intrinsic.getPrototypeOf(_createHash("sha256"));
+var _hashUpdate = intrinsic.uncurry(_hashProto.update);
+var _hashDigest = intrinsic.uncurry(_hashProto.digest);
+
+/** @internal The MAC operations, captured at load. `node:crypto` exports no Hmac constructor either,
+ *  and an Hmac does not share the Hash prototype, so it gets its own pair. */
+var _createHmac = nodeCrypto.createHmac;
+var _hmacProto = intrinsic.getPrototypeOf(_createHmac("sha256", "x"));
+var _hmacUpdate = intrinsic.uncurry(_hmacProto.update);
+var _hmacDigest = intrinsic.uncurry(_hmacProto.digest);
+
+/** @internal The native signature operations, captured at load. */
+var _nodeVerify = nodeCrypto.verify;
+var _nodeSign = nodeCrypto.sign;
+
+/** @internal The constant-time comparison, captured at load. It is the operation a MAC verdict rests
+ *  on, so a replacement answering `true` accepts any equal-length wrong MAC. */
+var _timingSafeEqual = nodeCrypto.timingSafeEqual;
+
+/** @internal The RSA padding and salt-length values, in one home rather than read from the module at
+ *  each call site. MEASURED: this is NOT a capture against replacement, because there is nothing to
+ *  capture against. `crypto.constants` is a non-writable, non-configurable property of the module and
+ *  each value on it is non-writable and non-configurable too, so assignment silently fails,
+ *  `defineProperty` throws, and replacing the whole object silently fails. What this gives is one place
+ *  that answers which padding scheme a verb runs under, so a reader does not re-derive the question per
+ *  module and a new module does not pick a value by copying a neighbor. */
+var _nodeConstants = nodeCrypto.constants;
+var padding = _freeze({
+  RSA_PKCS1: _nodeConstants.RSA_PKCS1_PADDING,
+  RSA_PKCS1_OAEP: _nodeConstants.RSA_PKCS1_OAEP_PADDING,
+  RSA_PKCS1_PSS: _nodeConstants.RSA_PKCS1_PSS_PADDING,
+});
+var saltLength = _freeze({
+  AUTO: _nodeConstants.RSA_PSS_SALTLEN_AUTO,
+  DIGEST: _nodeConstants.RSA_PSS_SALTLEN_DIGEST,
+});
+
+/** @internal The key imports, captured at load. A verifier checks a signature against whatever key
+ *  object it is handed, so the import decides the verdict as surely as the verifier does: one
+ *  returning another genuine key of the same family makes a signature made by that key verify against
+ *  the material a caller pinned. */
+var _createPublicKey = nodeCrypto.createPublicKey;
+var _createPrivateKey = nodeCrypto.createPrivateKey;
+var _createSecretKey = nodeCrypto.createSecretKey;
+
+/** @internal The three KeyObject `export` methods, captured at load. `node:crypto` exports no
+ *  constructor carrying them: `KeyObject.prototype` has no `export`, and `PublicKeyObject`,
+ *  `PrivateKeyObject` and `SecretKeyObject` each own one. So one sample pair and one secret key are
+ *  made here to read the three prototypes from, measured at 0.02 ms, and the keys are discarded.
+ *
+ *  The sample is a P-256 pair, and the generation is part of `require`. An algorithm outside the
+ *  FIPS 140-3 boundary would therefore make the whole package unloadable under `crypto.setFips(1)`:
+ *  OpenSSL's FIPS provider carries no Ed25519, so the generation raises ERR_OSSL_EVP_UNSUPPORTED
+ *  before any export is reached, and a caller needing only approved RSA or EC operations could not
+ *  require the package at all. The prototypes do not depend on the algorithm, measured across the
+ *  Ed25519, P-256 and RSA pairs, so one approved pair yields both. */
+var _sampleKeyPair = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "prime256v1" });
+var _publicProto = intrinsic.getPrototypeOf(_sampleKeyPair.publicKey);
+var _privateProto = intrinsic.getPrototypeOf(_sampleKeyPair.privateKey);
+var _secretProto = intrinsic.getPrototypeOf(_createSecretKey(intrinsic.bufferAlloc(32)));
+var _publicExport = intrinsic.uncurry(_publicProto.export);
+var _privateExport = intrinsic.uncurry(_privateProto.export);
+var _secretExport = intrinsic.uncurry(_secretProto.export);
+
+/** A signature verified through the operation captured at load. Same arguments as `crypto.verify`.
+ *
+ * `crypto.verify` is an ordinary writable property of the module object, and it was read once per
+ * signature at every call site, so a replacement installed after the package loaded decided the
+ * verdict: one returning `true` made TUF metadata carrying a 64-byte all-zero signature meet its
+ * threshold against a genuine pinned key. That is the whole answer, not a detail of it.
+ *
+ * The shape excludes its own routing call: `guard.crypto.verify(` contains `crypto.verify(`, so
+ * without the lookbehind the detector fires on every consumer it is meant to bless.
+ *
+ * @enforced-by guard-shape-reinlined
+ * @guard-shape (?<!guard\.)(?:nodeCrypto|crypto)\.verify\s*\(
+ */
+function verify(algorithm, data, key, signature) {
+  return _nodeVerify(algorithm, data, key, signature);
+}
+
+/** A signature produced through the operation captured at load. Same arguments as `crypto.sign`.
+ *
+ * Captured for the reason `verify` above gives: a replaced signer produces a signature over bytes
+ * the caller did not ask about, and the key-pair probe in `pki.key` checks a signature it made
+ * itself, so a replacement that agreed with its own forgery would pass the probe.
+ *
+ * @enforced-by guard-shape-reinlined
+ * @guard-shape (?<!guard\.)(?:nodeCrypto|crypto)\.sign\s*\(
+ */
+function sign(algorithm, data, key) {
+  return _nodeSign(algorithm, data, key);
+}
+
+/** A digest taken through operations captured at load. `createHash(name).update(b).digest()` reaches
+ * `update` and `digest` off the live hash prototype, both ordinary writable properties, so a
+ * replacement decides what the digest is OVER. Measured: a replaced `update` that filled the content
+ * buffer before forwarding put the digest of other bytes into the attribute set
+ * `pki.cms.authenticate` computes its MAC over, and the message then failed to verify against the
+ * content it carries. A digest in this toolkit names a key, binds a certificate, or is the value a
+ * signature covers, so the operation that computes it is not the caller's to choose.
+ *
+ * @enforced-by behavioral -- the shape detector for this one is written and NOT armed. Its rule is
+ * `createHash\s*\([^)]*\)\s*\.(?:update|digest)\s*\(`, which is rename-proof and would catch the class
+ * anywhere, and 19 sites across 11 lib modules still carry it, so arming it now would fail the gate on
+ * a clean tree. It arms with that migration. A module that captures `createHash` into a local and then
+ * chains off it is the worst of the three states, since it reads as converted and is not: those are
+ * gone. Until then the guard is the RED conformance vector: a
+ * replaced hash `update` cannot choose the content a message digest covers, driven through
+ * `pki.cms.authenticate` and read back with `pki.cms.decrypt`.
+ */
+function digest(name, bytes) {
+  return _hashDigest(_hashUpdate(_createHash(name), bytes));
+}
+
+/** A digest over SEVERAL parts, fed in order through the operations captured at load. It is `digest`
+ * for a preimage the caller assembles as a list rather than as one buffer, which keeps a multi-part
+ * hash from having to concatenate first: a transparency-log key identifier is a digest over a name, a
+ * separator, an algorithm byte and the key, and the identifier is what matches a signature line to a
+ * caller's key.
+ *
+ * A part is passed to the captured `update` as it is, so a string part is read as UTF-8 exactly as
+ * `hash.update(string)` would read it.
+ *
+ * @enforced-by behavioral -- shares the unarmed shape `digest` below describes.
+ */
+function digestParts(name, parts) {
+  var h = _createHash(name);
+  for (var i = 0; i < parts.length; i++) _hashUpdate(h, parts[i]);
+  return _hashDigest(h);
+}
+
+/** An extendable-output function squeezed to `outLen` bytes, through the operations captured at load.
+ * A single-stage KDF derives a key pair and the HPKE key schedule's secrets this way, so a replaced
+ * `update` chooses what the derivation covers and a replaced `digest` chooses the key material itself.
+ * Measured: an `update` returning its receiver without forwarding made two X25519/SHAKE128 setups with
+ * different encapsulations derive identical exports, so a session key no longer depended on the
+ * encapsulation it was negotiated under.
+ *
+ * @enforced-by behavioral -- shares the unarmed shape `digest` above describes. The guard is the RED
+ * conformance vector: two HPKE setups whose encapsulations differ must not export the same secret
+ * while the hash prototype is replaced.
+ */
+function xof(name, bytes, outLen) {
+  return _hashDigest(_hashUpdate(_createHash(name, { outputLength: outLen }), bytes));
+}
+
+/** A MAC over `bytes` under `key`, through the operations captured at load. HKDF-Extract and each
+ * HKDF-Expand round are MACs, so a replacement here decides the pseudo-random key an entire key
+ * schedule hangs off, and the HPKE and CMC paths both derive their traffic keys through it.
+ *
+ * @enforced-by behavioral -- the Hmac prototype's `update` and `digest` are ordinary writable
+ * properties, with the same absence of a rename-proof shape as `digest` above. The guard is the RED
+ * conformance vector over the key schedule.
+ */
+function hmac(name, key, bytes) {
+  return _hmacDigest(_hmacUpdate(_createHmac(name, key), bytes));
+}
+
+/** A key imported through the operation captured at load. Same arguments as `crypto.createPublicKey`,
+ * `crypto.createPrivateKey` and `crypto.createSecretKey`.
+ *
+ * @enforced-by behavioral -- the shape `nodeCrypto\.create(?:Public|Private|Secret)Key\s*\(` is
+ * rename-proof and would catch the class anywhere, and 42 sites across 9 lib modules still reach the
+ * module property directly on the key-agreement, KEM and key-format paths, so arming it now would fail
+ * the gate on a clean tree. It arms with that migration. Until then the guard is the RED conformance
+ * vector: a replaced `crypto.createPublicKey` returning another genuine key cannot substitute the key a
+ * signature is verified against, driven through `pki.tlog.verifyNote` and `pki.key.publicFromPrivate`.
+ */
+function publicKey(spec) { return _createPublicKey(spec); }
+
+// @enforced-by behavioral -- shares the migration note on `publicKey` above; the signer's own key is
+function privateKey(spec) { return _createPrivateKey(spec); }
+
+// @enforced-by behavioral -- shares the migration note on `publicKey` above; a MAC key substituted at
+function secretKey(material) { return _createSecretKey(material); }
+
+/** A KeyObject exported through the operation captured at load. `keyObject.export(spec)` reaches the
+ * method off the live prototype, so a replacement decides the bytes a caller is handed: one exporting
+ * a fixed value made two distinct authorized TUF keys carry the same material identifier, which took a
+ * two-key threshold down to one signature. The method is chosen by the key's PROTOTYPE rather than by
+ * its `type`, which is itself a replaceable accessor, and an object whose prototype is none of the
+ * three is refused rather than guessed at.
+ *
+ * @enforced-by behavioral -- shares the migration note on the imports above.
+ */
+function exportKey(keyObject, spec) {
+  var proto = keyObject === null || keyObject === undefined ? null : intrinsic.getPrototypeOf(keyObject);
+  if (proto === _publicProto) return _publicExport(keyObject, spec);
+  if (proto === _privateProto) return _privateExport(keyObject, spec);
+  if (proto === _secretProto) return _secretExport(keyObject, spec);
+  throw new TypeError("guard.crypto.exportKey: expects a node:crypto KeyObject");
+}
 
 // @enforced-by guard-shape-reinlined
 // @guard-shape \.timingSafeEqual\s*\(
 function constantTimeEqual(a, b) {
-  return a.length === b.length && nodeCrypto.timingSafeEqual(a, b);
+  return a.length === b.length && _timingSafeEqual(a, b);
 }
 
 // @enforced-by behavioral -- shares the octet-alignment rule below; a bare
@@ -25,4 +223,8 @@ function assertOctetAligned(bitString, E, code, label) {
   return bitString;
 }
 
-module.exports = _freeze({ constantTimeEqual: constantTimeEqual, isOctetAligned: isOctetAligned, assertOctetAligned: assertOctetAligned });
+module.exports = _freeze({ constantTimeEqual: constantTimeEqual, digest: digest,
+  digestParts: digestParts, xof: xof, hmac: hmac, verify: verify, sign: sign,
+  publicKey: publicKey, privateKey: privateKey, secretKey: secretKey, exportKey: exportKey,
+  padding: padding, saltLength: saltLength,
+  isOctetAligned: isOctetAligned, assertOctetAligned: assertOctetAligned });

package/lib/guard-encoding.js

@@ -142,7 +142,12 @@ function percentEncode(bytes, E, code, label) {
 
 /** @internal One path segment of a URI, built from `text` read as its latin1 bytes. Every byte
  * outside the unreserved set becomes a triplet, so a value carrying `/`, `?`, `#` or a percent of
- * its own cannot reach past the segment it was placed in. */
+ * its own cannot reach past the segment it was placed in.
+ *
+ * @enforced-by behavioral -- the encoding itself is `percentEncode`, whose shape detector catches a
+ * re-inlined triplet anywhere in lib/; what this adds is reading the text as its latin1 bytes, which is a
+ * conversion with no shape of its own, pinned by the vector that a character above 0x7f encodes as the
+ * bytes latin1 gives it rather than as its UTF-8 pair */
 function uriPathSegment(text, E, code, label) {
   if (typeof text !== "string") {
     throw _rawError(E)(code, (label || "URI path segment") + " must be a string");

package/lib/guard-identifier.js

@@ -40,7 +40,8 @@ var _Number = intrinsic.Number;
 var _BigInt = intrinsic.BigInt;
 var _Object = intrinsic.Object;
 var _BufferProto = intrinsic.BufferProto;
-var _append = require("./guard-list").append;
+var guardList = require("./guard-list");
+var _append = guardList.append;
 
 function _isDottedDecimal(str) {
   if (str.length === 0) return false;
@@ -108,9 +109,16 @@ function snapshotOptions(obj, known) {
 function optionNames(obj, known) {
   if (obj === null || obj === undefined) return [];
   var out = [];
-  _forEach(_ownKeys(_Object(obj)), function (k) {
+  var o = _Object(obj);
+  _forEach(_ownKeys(o), function (k) {
     if (typeof k !== "string") return;
-    if (known !== null && known !== undefined && !_hasOwn(known, k)) return;
+    var recognized = known !== null && known !== undefined && _hasOwn(known, k);
+    if (known !== null && known !== undefined && !recognized) return;
+    /** @internal The non-thenable mask is the object's machinery rather than one of its options, and a
+     * caller building its list of named forms from this found one more form than the object carries.
+     * A caller that RECOGNIZES the name means it as content, so the exemption stands aside: the whole
+     * mechanism is about a name nothing asked for. */
+    if (!recognized && _isOwnStructuralName(o, k, _getOwnPropertyDescriptor(o, k), false)) return;
     _append(out, k);
   });
   return out;
@@ -127,6 +135,10 @@ function ownOptions(obj) {
   var o = _Object(obj);
   _forEach(_ownKeys(o), function (k) {
     if (typeof k !== "string") return;
+    /** @internal The copy has a null prototype, so there is no inherited `then` for a non-thenable
+     * mask to stand in front of, and copying one in would turn a hidden name holding `undefined` into
+     * a visible option the next door reports as unknown. */
+    if (_isOwnStructuralName(o, k, _getOwnPropertyDescriptor(o, k), false)) return;
     out[k] = o[k];
   });
   return out;
@@ -153,7 +165,11 @@ function _requireFactory(E) {
 
 function _refuseUnenumerable(v, E, code, label) {
   _requireFactory(E);
-  if (v === null || typeof v !== "object") return;
+  /** @internal A Proxy whose TARGET is a function reports `typeof "function"`, so a receiver tested for
+   * `typeof !== "object"` was returned on unexamined: one hid an own `then` through its `ownKeys` trap
+   * and the name walk above never saw it. A callable receiver is examined the same way; a plain
+   * function is not a Proxy and still passes through. */
+  if (v === null || (typeof v !== "object" && typeof v !== "function")) return;
   var visited = new _Set();
   for (var o = v; o && !_setHas(visited, o); o = _getPrototypeOf(o)) {
     _setAdd(visited, o);
@@ -209,6 +225,10 @@ var _TYPED_ARRAY_PROTO = _getPrototypeOf(Uint8Array.prototype);
 var _INTRINSIC_HOLDERS = (function () {
   var m = new _Map([[_TYPED_ARRAY_PROTO, _TYPED_PROTO_MEMBERS]]);
   function pair(ctor, members) { if (ctor && ctor.prototype) _mapSet(m, ctor.prototype, members); }
+  /** @internal This map IS the record of what the real intrinsic prototypes were when the package
+   *  loaded, so reading a global here is the capture rather than a call-time read of one: a
+   *  replacement installed afterwards cannot change a map already built. */
+  // allow:guard-reads-runtime-live -- module-init, see above
   pair(Array, _ARRAY_PROTO_MEMBERS);
   pair(RegExp, _REGEXP_PROTO_MEMBERS);
   _forEach([Map, Set], function (c) { pair(c, _SIZED_PROTO_MEMBERS); });
@@ -216,6 +236,7 @@ var _INTRINSIC_HOLDERS = (function () {
   pair(ArrayBuffer, _ARRAYBUFFER_PROTO_MEMBERS);
   pair(typeof SharedArrayBuffer === "function" ? SharedArrayBuffer : null, _SHARED_PROTO_MEMBERS);
   pair(DataView, _DATAVIEW_PROTO_MEMBERS);
+  // allow:guard-reads-runtime-live -- module-init, see above
   pair(Buffer, _BUFFER_PROTO_MEMBERS);
   _forEach(_getOwnPropertyNames(globalThis), function (n) {
     var d = _getOwnPropertyDescriptor(globalThis, n);
@@ -256,8 +277,24 @@ function _kindMembers(v) {
   return [];
 }
 
-function _isOwnStructuralName(v, k) {
-  return util.types.isRegExp(v) && k === "lastIndex";
+function _isOwnStructuralName(v, k, d, inherited) {
+  if (util.types.isRegExp(v) && k === "lastIndex") return true;
+  /** @internal The non-thenable mask `guard.verdict.shield` leaves on a value the toolkit hands back:
+   * a non-enumerable own `then` holding `undefined`. It is part of the object's machinery rather than
+   * its content, and a name holding `undefined` answers nothing to a reader either way, so counting it
+   * had the toolkit refuse its OWN output: `pki.jose.parseJson` returns a shielded object, and a
+   * caller passing one as an options bag was told `then` was an unknown option while the same document
+   * through `JSON.parse` was accepted. An own `then` holding a VALUE is content and is still counted,
+   * so a document that really carries one is still reported. */
+  /** @internal A DATA descriptor, asked for the way `shield` asks: a descriptor carrying no `value`
+   * key is an accessor, and `{get: undefined, set: undefined}` is an accessor whose reads answer
+   * `undefined`, which `!d.get && !d.set` alone mistook for data.
+   * And a descriptor only means what it says when the object answering for it is a real one. A Proxy
+   * reports whatever its trap returns, so one reporting the mask's shape for a `then` that reads 42
+   * would have the name hidden and the value live. A Proxy is refused at every door that validates;
+   * here it simply does not qualify. */
+  return !inherited && k === "then" && !!d && _hasOwn(d, "value") &&
+    d.enumerable === false && d.value === undefined && !util.types.isProxy(v);
 }
 
 function _looksIntrinsic(d) {
@@ -292,8 +329,8 @@ function _readableNames(obj) {
       if (seen[k]) return;
       if (indexedSelf && typeof k === "string" && _isArrayIndex(k)) return;
       if (indexedSelf && k === "length" && !inherited) return;
-      if (_isOwnStructuralName(obj, k)) return;
       var d = _getOwnPropertyDescriptor(o, k);
+      if (_isOwnStructuralName(obj, k, d, inherited)) return;
       var here = _holderMembers(o);
       if (inherited && _looksIntrinsic(d) && !_shadowsAnother(obj, k, o) &&
           (here === null ? _indexOf(members, k) !== -1 : _indexOf(here, k) !== -1)) return;
@@ -364,6 +401,11 @@ function _proxyInChain(v) {
   }
   return false;
 }
+/** @internal The predicate form of `assertPlainRecord`, for a caller deciding rather than refusing.
+ *
+ *  @enforced-by behavioral -- a plain-record test has no single rename-proof shape that a legitimate
+ *  `typeof v === "object"` does not also match; the vectors driving a Proxy, an array, a Buffer and a
+ *  built-in exotic through it are the guard */
 function isPlainRecord(v) {
   if (v === null || typeof v !== "object") return false;
   if (_proxyInChain(v)) return false;
@@ -402,7 +444,12 @@ function _descriptorHolder(v, k) {
 
 // @enforced-by behavioral -- reading an accessor before it is refused has no rename-proof code
 function refuseAccessorFields(obj, names, E, code, label) {
-  for (var i = 0; i < names.length; i++) {
+  /** @internal The count is narrowed where it is taken, as every walk in `guard.list` is. This is a
+   * DOOR, and `i < names.length` asked a caller's list for its length on every comparison: a Proxy over
+   * `["a", "secret"]` whose length coerced to 2 and then to 0 had this walk pass the accessor named
+   * `secret` and return as though it had checked it. */
+  var n = guardList.count(names, "refuseAccessorFields");
+  for (var i = 0; i < n; i++) {
     var holder = _descriptorHolder(obj, names[i]);
     if (holder && (holder.get || holder.set)) {
       throw E(code, label + " supplies " +

package/lib/guard-intrinsic.js

@@ -47,8 +47,27 @@ var _mathCeil = Math.ceil;
 var _mathMin = Math.min;
 var _mathMax = Math.max;
 var _parseInt = parseInt;
+/** @internal The promise constructor itself, captured at load. `Promise.resolve` and `Promise.reject`
+ *  are captured below, but they build their promise from the RECEIVER they are called on, so reading
+ *  the global binding at the call hands the construction to whatever that binding holds. A verdict
+ *  returned as `Promise.resolve(false)` from a hostile constructor is not a refusal. */
+var _Promise = Promise;
 var _promiseResolve = Promise.resolve;
 var _promiseReject = Promise.reject;
+/** @internal The aggregators, captured alongside them. `all` is what assembles a verdict out of
+ *  component results, so a replacement that resolves a fabricated array never awaits the components
+ *  and hands its own values to the caller as the verdict. All four are captured together: a member
+ *  with no captured form is a member that stays live. */
+var _promiseAll = Promise.all;
+var _promiseAllSettled = Promise.allSettled;
+var _promiseRace = Promise.race;
+var _promiseAny = Promise.any;
+/** @internal The factory methods, captured for the same reason. `withResolvers` hands back the resolve
+ *  and reject capability for a promise it built, and `try` decides whether the callback runs at all, so
+ *  a replacement of either chooses what the caller goes on to settle or never settles. Both are
+ *  present on the supported runtime floor. */
+var _promiseTry = Promise["try"];
+var _promiseWithResolvers = Promise.withResolvers;
 var _asyncIterator = Symbol.asyncIterator;
 
 var _arrForEach = uncurry(Array.prototype.forEach);
@@ -57,11 +76,23 @@ var _arrFilter = uncurry(Array.prototype.filter);
 var _arrEvery = uncurry(Array.prototype.every);
 var _arrSome = uncurry(Array.prototype.some);
 var _arrIndexOf = uncurry(Array.prototype.indexOf);
+/** @internal The in-place sort, captured at load. A DER SET OF is ordered by its encoded bytes, so the
+ *  sort decides the bytes emitted: MEASURED, a replaced `slice` or `sort` made an attribute set encode a
+ *  member other than the one that was validated, on a path whose output is then signed. */
 var _arrSort = uncurry(Array.prototype.sort);
 var _arrConcat = uncurry(Array.prototype.concat);
 var _arrSlice = uncurry(Array.prototype.slice);
 var _arrJoin = uncurry(Array.prototype.join);
 var _arrPush = uncurry(Array.prototype.push);
+/** @internal The mutators. A list is what a rule is enforced over, so an operation that drops or moves
+ *  an element decides whether the rule reaches it: a replaced `pop` that popped twice took a signed
+ *  note's last signature line away with the empty tail element, and the forged signature on that line
+ *  was never checked. */
+var _arrPop = uncurry(Array.prototype.pop);
+var _arrShift = uncurry(Array.prototype.shift);
+var _arrUnshift = uncurry(Array.prototype.unshift);
+var _arrSplice = uncurry(Array.prototype.splice);
+var _arrReverse = uncurry(Array.prototype.reverse);
 
 var _strToUpperCase = uncurry(String.prototype.toUpperCase);
 var _strToLowerCase = uncurry(String.prototype.toLowerCase);
@@ -179,6 +210,11 @@ module.exports = Object.freeze({
   max: _mathMax,
   parseInt: _parseInt,
   push: _arrPush,
+  pop: _arrPop,
+  shift: _arrShift,
+  unshift: _arrUnshift,
+  splice: _arrSplice,
+  reverse: _arrReverse,
   toUpperCase: _strToUpperCase,
   toLowerCase: _strToLowerCase,
   stringIndexOf: _strIndexOf,
@@ -186,8 +222,15 @@ module.exports = Object.freeze({
   arrayBufferSlice: _abSlice,
   numberToString: _numToString,
   bigIntToString: _bigIntToString,
+  Promise: _Promise,
   promiseResolve: _promiseResolve,
   promiseReject: _promiseReject,
+  promiseAll: _promiseAll,
+  promiseAllSettled: _promiseAllSettled,
+  promiseRace: _promiseRace,
+  promiseAny: _promiseAny,
+  promiseTry: _promiseTry,
+  promiseWithResolvers: _promiseWithResolvers,
   asyncIterator: _asyncIterator,
   forEach: _arrForEach,
   map: _arrMap,

package/lib/guard-json.js

@@ -11,6 +11,10 @@ var _strSlice = require("./guard-intrinsic").uncurry(String.prototype.slice);
 var _hasOwn = require("./guard-intrinsic").hasOwn;
 var _Number = require("./guard-intrinsic").Number;
 var _isFinite = require("./guard-intrinsic").isFinite;
+var _BigInt = require("./guard-intrinsic").BigInt;
+/** @internal The largest integer a double holds exactly, as a BigInt, for `spec.exactIntegers`. Past it a
+ *  value reads back as a different one: 2^53 + 1 converts to 2^53. */
+var _MAX_EXACT = _BigInt(Number.MAX_SAFE_INTEGER);
 var _stringify = require("./guard-intrinsic").stringify;
 var _append = require("./guard-list").append;
 var limits = require("./guard-limits");
@@ -46,6 +50,9 @@ function parse(input, ErrorClass, spec) {
     fail("unexpected token");
     return undefined;
   }
+  /** @internal The member name whose value is being parsed, or null at the top level and inside an array.
+   *  Read only by the number policy below. */
+  var currentMember = null;
   function object(depth) {
     i++;
     var out = {};
@@ -59,7 +66,17 @@ function parse(input, ErrorClass, spec) {
       ws();
       if (str[i] !== ":") fail("expected ':'");
       i++;
-      _defineProperty(out, key, { value: value(depth + 1), writable: true, enumerable: true, configurable: true });
+      /** @internal The member name is carried into the value so a per-member number policy can apply to
+       *  the members that need it. A document can be ordinary JSON, where a fractional number is legal
+       *  somewhere in it, and still read ONE member as an integer: the FIDO metadata BLOB carries
+       *  biometric false-accept rates as genuine doubles beside a rollback counter that must be an exact
+       *  integer, so a document-wide rule refuses the real catalogue and no rule at all leaves the
+       *  counter readable as a rounded spelling. */
+      var outerMember = currentMember;
+      currentMember = key;
+      var memberValue;
+      try { memberValue = value(depth + 1); } finally { currentMember = outerMember; }
+      _defineProperty(out, key, { value: memberValue, writable: true, enumerable: true, configurable: true });
       ws();
       if (str[i] === ",") { i++; continue; }
       if (str[i] === "}") { i++; return out; }
@@ -71,13 +88,21 @@ function parse(input, ErrorClass, spec) {
     var out = [];
     ws();
     if (str[i] === "]") { i++; return out; }
-    for (;;) {
-      _append(out, value(depth + 1));
-      ws();
-      if (str[i] === ",") { i++; continue; }
-      if (str[i] === "]") { i++; return out; }
-      fail("expected ',' or ']'");
-    }
+    /** @internal The enclosing member's name does not reach the elements. A per-member number policy names
+     *  a member whose VALUE is an integer, so a member holding an array holds no number for the rule to
+     *  apply to, and letting the name reach inside would constrain a whole subtree from one name: the
+     *  document-wide rule in miniature, and the shape that refuses a conforming document. */
+    var outerMember = currentMember;
+    currentMember = null;
+    try {
+      for (;;) {
+        _append(out, value(depth + 1));
+        ws();
+        if (str[i] === ",") { i++; continue; }
+        if (str[i] === "]") { i++; return out; }
+        fail("expected ',' or ']'");
+      }
+    } finally { currentMember = outerMember; }
   }
   function string() {
     i++;
@@ -121,18 +146,106 @@ function parse(input, ErrorClass, spec) {
     var intLen = i - intStart;
     if (intLen === 0) fail("malformed number");
     if (intLen > 1 && str[intStart] === "0") fail("malformed number");
+    var intDigits = _strSlice(str, intStart, i);
+    var fracDigits = "";
+    var expValue = 0;
+    var notAnInteger = false;
     if (str[i] === ".") {
       i++;
       var fracStart = i;
       while (i < n && str[i] >= "0" && str[i] <= "9") i++;
       if (i === fracStart) fail("malformed number");
+      fracDigits = _strSlice(str, fracStart, i);
+      notAnInteger = true;
     }
     if (str[i] === "e" || str[i] === "E") {
       i++;
-      if (str[i] === "+" || str[i] === "-") i++;
+      var expNeg = false;
+      if (str[i] === "+") i++;
+      else if (str[i] === "-") { expNeg = true; i++; }
       var expStart = i;
       while (i < n && str[i] >= "0" && str[i] <= "9") i++;
       if (i === expStart) fail("malformed number");
+      /** @internal The exponent is read as written, with no bound on its spelling. Bounding the character
+       *  COUNT refuses valid numbers: `1e0000000` is 1 and `0e1000000` is 0, both exactly representable,
+       *  and the bound applied to every caller whether or not one asked for an integer policy. Nothing
+       *  below needs the bound, because the exact-integer decision is taken from digit COUNTS and never
+       *  expands the value, and a magnitude that overflows a double is caught by the `_isFinite` check
+       *  that every number already passes through. */
+      expValue = _Number(_strSlice(str, expStart, i));
+      if (expNeg) expValue = -expValue;
+      notAnInteger = true;
+    }
+    /** @internal `spec.integersOnly` refuses a fractional or exponent-form token HERE, while the token is
+     *  still text. Conversion to a Number loses the distinction: 1.0000000000000001 becomes 1, so a check
+     *  for an integer afterwards sees one and a format that permits only integers has been read as
+     *  conforming. A caller asks for this when its own format forbids floating point. */
+    if (spec.integersOnly && notAnInteger) {
+      fail("a fractional or exponent-form number, where this format admits only integers");
+    }
+    /** @internal `spec.exactIntegers` is the laxer rule, for a format that is ordinary JSON but will treat
+     *  this value as an integer. It refuses nothing a producer may legally write: `1e3`, `1.0` and
+     *  `1500e-2` all denote integers and are accepted. What it refuses is a spelling whose VALUE is not
+     *  exactly its own integer, which conversion to a Number cannot be asked about afterwards:
+     *  `1.0000000000000001` becomes 1, so an `isInteger` check made after conversion sees a conforming
+     *  document and the value the caller reports is not the spelling the producer sent. Where that value
+     *  is folded back into a binary preimage, as a CT tree size is, the rounded spelling verifies.
+     *
+     *  Decided on the DIGITS, with no float arithmetic: the token is `digits x 10^scale`, so it denotes an
+     *  integer exactly when the scale is non-negative or when every digit the scale would drop is a zero.
+     *  The resulting integer must also be one a double holds exactly, since 2^53 + 1 reads back as 2^53
+     *  and that is the same loss by another route. */
+    /** @internal The rule applies to every number when `spec.exactIntegers` is set, and to the named
+     *  members alone when `spec.exactIntegerMembers` is. The second form is for a document that is
+     *  ordinary JSON, where a fractional number is legal somewhere in it, but reads one member as an
+     *  integer: the FIDO metadata BLOB is that, and the live catalogue carries ten genuinely non-integral
+     *  biometric rates, so the document-wide rule refuses it outright. Verified against the published
+     *  BLOB rather than against the specification text. */
+    var exactWanted = spec.exactIntegers ||
+      (spec.exactIntegerMembers && currentMember !== null && _hasOwn(spec.exactIntegerMembers, currentMember));
+    if (exactWanted) {
+      var digits = intDigits + fracDigits;
+      var scale = expValue - fracDigits.length;
+      /** @internal Decided from the DIGIT COUNT and the scale, never by expanding the value. Computing
+       *  `digits x 10^scale` to find out whether it is an integer means building the power first, and an
+       *  exponent is six digits wide: `0e999999` expands to a million digits and then multiplies by a
+       *  zero mantissa, so it passed, and a document can carry one such token per few bytes of its size
+       *  cap. Measured at 1566 ms for a 907-byte CT response before this. Nothing below constructs a
+       *  BigInt until the value is known to be small. */
+      var lead = 0;
+      while (lead < digits.length && digits[lead] === "0") lead++;
+      if (lead === digits.length) {
+        /** @internal Every digit is a zero, so the value is zero whatever the scale, and zero is an
+         *  exact integer. Taken here because it is also the shape that made the expansion free to
+         *  request: `0e999999` is this case. */
+        var zeroValue = _Number(_strSlice(str, start, i));
+        if (!_isFinite(zeroValue)) fail("bad number");
+        return zeroValue;
+      }
+      /** @internal The significant digits, and the trailing zeros among them that the scale may cancel.
+       *  A negative scale drops that many digits off the end, and the value is an integer only when every
+       *  digit it drops is a zero. Counted rather than sliced, so a long mantissa costs a scan. */
+      var lastSig = digits.length - 1;
+      while (lastSig > lead && digits[lastSig] === "0") lastSig--;
+      var trailingZeros = digits.length - 1 - lastSig;
+      if (scale < 0 && -scale > trailingZeros) {
+        fail("a number whose value is not exactly an integer, where this format reads it as one");
+      }
+      /** @internal The integer's decimal width, from the counts alone. MAX_SAFE_INTEGER is 16 digits, so
+       *  anything wider than that is outside the exactly-representable range and is refused before a
+       *  BigInt exists. Only a value already known to be at most 17 digits reaches the arithmetic. */
+      var sigCount = lastSig - lead + 1;
+      var intWidth = sigCount + scale + trailingZeros;
+      if (intWidth > 17) {
+        fail("an integer beyond the range a double represents exactly, so the value read back would not be the value written");
+      }
+      var exactDigits = _strSlice(digits, lead, lastSig + 1);
+      var zerosAfter = scale + trailingZeros;
+      for (var pad = 0; pad < zerosAfter; pad++) exactDigits += "0";
+      var exact = _BigInt(exactDigits);
+      if (exact > _MAX_EXACT) {
+        fail("an integer beyond the range a double represents exactly, so the value read back would not be the value written");
+      }
     }
     var v = _Number(_strSlice(str, start, i));
     if (!_isFinite(v)) fail("bad number");

package/lib/guard-limits.js

@@ -79,6 +79,12 @@ function BudgetExceeded(message) {
   return e;
 }
 
+/** @internal Whether a caught error is the budget throw above, which a door converts to its own typed
+ *  refusal.
+ *
+ *  @enforced-by behavioral -- reading one marker property off a caught error is the shape of any error
+ *  test; the vector that a door converts a budget throw to its own typed refusal, and rethrows anything
+ *  else unchanged, is the guard */
 function isBudgetExceeded(e) {
   return !!(e && e.budgetExceeded === true);
 }
@@ -86,7 +92,12 @@ function isBudgetExceeded(e) {
 /** @internal One budget per top-level parse, carried into every nested decode. `exhausted`
  *  latches, and the object is frozen, so a caller that catches the throw cannot clear it. A
  *  door that re-reads the latch before returning a result therefore still refuses, whatever
- *  code between the two caught the exception. */
+ *  code between the two caught the exception.
+ *
+ *  @enforced-by behavioral -- an accumulator that throws past a maximum is the shape of every bounded
+ *  loop in the toolkit, so no pattern separates this from one; the guard is the vector that the latch
+ *  stays set after a caller catches the throw, which a re-implementation that tracked the total without
+ *  latching would fail */
 function budget(limits) {
   var spent = 0;
   var exhausted = false;